Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Istio bug bounty programs

istio.io Updated

Istio runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
14
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Istio runs.

  • Istio

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial
    First response
    3 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

14 targets. 6 excluded.

  • https://istio.io

    Web

  • AuthorizationPolicy, RequestAuthentication and PeerAuthentication evaluation, including path, header, method and principal matching and the interaction between ALLOW, DENY and CUSTOM actions

    Products and areas

  • Gateway API support alongside the Gateway, VirtualService and DestinationRule resources, and the route matching each drives

    Products and areas

  • istioctl and the debug and status endpoints istiod exposes about mesh configuration

    Products and areas

  • istiod, the control plane, and the xDS configuration it computes and pushes to every proxy

    Products and areas

  • Multicluster deployments, trust domain federation, the east-west gateways and the remote secrets that let one cluster read another's endpoints

    Products and areas

  • Telemetry and tracing configuration, and the headers and metadata each adds to a request

    Products and areas

  • The ambient dataplane in full: ztunnel, the waypoint proxies, HBONE tunnelling and the policy enforcement point in each

    Products and areas

  • The CNI plugin and the traffic redirection it installs on the node

    Products and areas

  • The Envoy configuration Istio generates, the filters it enables, the extension provider mechanism and WASM extension loading

    Products and areas

  • The JWT validation path and the mapping from token claims to request principals and to policy conditions

    Products and areas

  • The published process asks for private reports to the Istio security mailing list and declares no boundary narrower than the Istio project. Everything below sits inside that

    Products and areas

  • The sidecar injection webhook and every field of the pod specification it produces, including the init container and the iptables rules it installs

    Products and areas

  • Workload identity issuance: the certificate authority istiod runs, the SDS path to each proxy, the SPIFFE identities it mints and the trust domain behind them

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • An AuthorizationPolicy an operator wrote that is simply more permissive than intended

  • Envoy upstream, a separate project with its own security process and a Google Patch Rewards pathway, unless Istio's configuration of it is what makes the defect reachable

  • Kubernetes itself and the container runtime beneath the mesh

  • The applications inside the mesh

  • Third-party WASM extensions and external authorization services the mesh is configured to call

  • Vendor distributions of Istio, which have their own advisory streams

Recent changes

Reward and scope changes across every Istio program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Istio products, from the NVD.

Search NVD
  • CVE-2026-111497 Critical

    A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli librarie

  • CVE-2026-41413 Medium

    Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created with a jwksUri pointing to an internal service, istiod makes an unauthenticated HTTP GET request to that URL without filtering out localhost or link local ips. This can result in sensitive data being distributed to Envoy proxies via xDS confi

  • CVE-2026-39350 Medium

    Istio is an open platform to connect, manage, and secure microservices. In versions 1.25.0 through 1.27.8, 1.28.0 through 1.28.5, 1.29.0, and 1.29.1, the serviceAccounts and notServiceAccounts fields in AuthorizationPolicy incorrectly interpret dots (.) as a regular expression matcher. Because . is a valid character in a service account name, an AuthorizationPolicy ALLOW rule targeting a service a

  • CVE-2026-31837 High

    Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a user of Istio is impacted if the JWKS resolver becomes unavailable or the fetch fails, exposing hardcoded defaults regardless of use of the RequestAuthentication resource. This vulnerability is fixed in 1.29.1, 1.28.5, and 1.27.8.

  • CVE-2026-31838 Medium

    Istio is an open platform to connect, manage, and secure microservices. Prior to 1.29.1, 1.28.5, and 1.27.8, a vulnerability in Envoy RBAC header matching could allow authorization policy bypass when policies rely on HTTP headers that may contain multiple values. An attacker could craft requests with multiple header values in a way that causes Envoy to evaluate the header differently than intended

  • CVE-2023-44487 High

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  • CVE-2022-39388 High

    Istio is an open platform to connect, manage, and secure microservices. In versions on the 1.15.x branch prior to 1.15.3, a user can impersonate any workload identity within the service mesh if they have localhost access to the Istiod control plane. Version 1.15.3 contains a patch for this issue. There are no known workarounds.

  • CVE-2022-39278 High

    Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted or oversized message which results in the control plane crashing when the Kubernetes

About this page

This page gathers every public program listed under istio.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.